Memory Corruption Vulnerability in bsdiff Package: CVE-2020-14315
Summary
CVE-2020-14315: A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Affects bsdiff across 2 version ranges.
< 4.3-22
< ce07a29894acd74c52b975a42c02f11d9483566a
Fixed in 4.3-22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bsdiff is a tool for creating and applying binary patches, widely used in software distribution to reduce the size of updates. It is part of Colin Percival's bsdiff tools, which are known for their efficiency in handling binary differences. However, the bsdiff package has been found to have a critical memory corruption vulnerability that can be exploited if not addressed.
Vulnerability Detail
CVE-2020-14315 is a memory corruption vulnerability found in the bsdiff tool, specifically in the bspatch function. The vulnerability arises from insufficient checks when handling external inputs, allowing an attacker to bypass sanity checks and write outside the boundaries of a dynamically allocated buffer. This can lead to arbitrary code execution, data corruption, or crashes, posing significant risks to systems using affected versions of the package.
How To Fix
Minimum fixed version
4.3-22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bsdiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the bsdiff tool for patching until they have upgraded to a secure version. Additionally, validating inputs before processing them can help mitigate the risk of exploitation.
Conclusion
CVE-2020-14315 represents a significant security risk for users of the bsdiff tool due to its memory corruption vulnerability. It is crucial for users to upgrade to the patched version to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bsdiff →
FAQ
CVE-2020-14315 is a memory corruption vulnerability in the bsdiff tool that allows attackers to exploit insufficient input checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, data corruption, or system crashes, posing serious security risks.
If an immediate upgrade is not possible, refrain from using the bsdiff tool and validate all inputs to reduce the risk of exploitation.
The CVSS score for CVE-2020-14315 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for bsdiff.
